Emirhan Kurt

🚨 CVE-2026-19862 The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field. 🎖@cveNotify

**Name of the Vulnerable Software and Affected Versions** Kirki WordPress plugin versions prior to 6.0.12 **Description** An issue exists where the software fails to validate a user-supplied URL before requesting it server-side. This allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making HTTP requests to arbitrary hosts. **Recommendations** Update Kirki WordPress plugin to version 6.0.12 or later.